User impersonation via playlist owner ID tampering

Parameter tampering in Navidrome before 0.52.0 allows remote authenticated users to impersonate known users through playlist updates. The playlist update endpoint accepts a client-supplied ownerId and persists it instead of binding ownership to the authenticated account. Exploitation requires a valid account, interception of that account's update request, and a target owner ID exposed by a shared playlist; it attributes attacker-controlled playlist content to the target.